Register Panorama with the ZTP Service for New Deployments

Install the Panorama Device Certificate.

Log in to the Palo Alto Networks Customer Support Portal (CSP).

Associate your Panorama with the ZTP Service on the Palo Alto Networks Customer Support Portal (CSP).

The ZTP Service supports associating up to two Panoramas only if they are in a high availability (HA) configuration. If Panorama is not in an HA configuration, only a single Panorama can be associated.

Select
Assets
ZTP Service
and
Associate Panorama(s)
.
Select the serial number of the Panorama managing your ZTP firewalls.
(
HA only
) Select the serial number of the Panorama HA peer.
Click
OK
.

Log in to the Panorama Web Interface.

Select

Panorama

Zero Touch Provisioning

Setup

and edit the

General

ZTP settings.

Register Panorama with the ZTP service.

Enable ZTP Service
.
Enter the
Panorama FQDN or IP Address
.
This is the FQDN or public IP address of the Panorama the ZTP plugin is installed on and that the CSP pushes to the ZTP firewalls.
(
All ZTP-enabled managed firewalls
) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
(
HA only
) Enter the
Peer FQDN or IP Address
.
This is the FQDN or public IP address of the Panorama peer on which the ZTP plugin is installed and that the CSP pushes to the ZTP firewalls in case of failover.
(
All ZTP-enabled managed firewalls
) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
Click
OK
to save your configuration changes.



Create the default device group and template to automatically generate the required configuration to connect your ZTP firewalls to Panorama.

Adding the device group and template automatically generates a new device group and template that contain the default configuration to connect the Panorama and the ZTP firewalls.

Add Device Group and Template
.
Enter the
Device Group
name.
Enter the
Template
name.
Click
OK
to save your configuration changes.



Add your ZTP firewalls to the device group and template specified in the previous step.

Select
Panorama
Device Groups
and select the device group that was automatically created.
Select the ZTP
Devices
.
Click
OK
to save your configuration changes.
Select
Panorama
Templates
and
Add Stack
.
In the
Templates
section,
Add
the template that was automatically generated.
Select the ZTP
Devices
.
Click
OK
to save your configuration changes.

Verify that the required device group and template configurations generated successfully.

Select
Network
Interfaces
Ethernet
and select the
Template
you created in the previous step.
Verify that
ethernet1/1
is configured with an IP Address, Virtual Router, and Security Zone.
Select
Network
Interfaces
Loopback
and select the
Template
you created in the previous step.
Verify that the
loopback.900
interface is successfully created.
Select
Policies
Security
Pre Rules
and select the
Device Group
you created in the previous step.
Verify that
rule1
is successfully created.
Select
Policies
NAT
Pre Rules
and select the
Device Group
you created in the previous step.
Verify that
ztp-nat
is successfully created.

Modify your device groups and templates as needed.

Create and configure new or existing device groups and templates to complete your deployment.

When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration is not overridden in the event of conflicting configurations.

Do not modify the IP address, virtual router, and Security zone of the

ethernet1/1

interface, the

loopback.900

loopback interface, the

rule1

Security policy rule, or

ztp-nat

NAT policy rule. These configurations are required to connect your ZTP firewall to Panorama.

Select

Commit

and

Commit to Panorama

Sync to ZTP Service

and verify that the Panorama Sync Status displays as

In Sync

.